# SSL/TLS Certificate Check

> SSL/TLS Certificate Check is a paid API for AI agents from ssl.use.x402atlas.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-11).

Inspects an HTTPS host's TLS certificate and connection, returning expiry, issuer, SANs, chain validity, hostname match, negotiated protocol/cipher, and weak-algorithm warnings as clean JSON.

## Facts

- Endpoint: GET https://ssl.use.x402atlas.com/check?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ssl-tls-certificate-check-cd25a77f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_S1g5T5-BdHFbB48ejh7Gy

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ssl-tls-certificate-check-cd25a77f
```

Example prompt: Check the SSL certificate for api.example.com — I want to know if it's expiring soon, who issued it, whether the chain is valid, and if there are any weak-algorithm warnings.

## When to prefer this

Use this endpoint when you need a quick, structured TLS/certificate inspection for a public HTTPS host without setting up your own OpenSSL tooling. It is ideal for automated monitoring pipelines, CI/CD pre-deployment checks, or ad-hoc security audits where you need expiry countdowns, chain validity, hostname matching, and weak-cipher warnings in a single clean JSON response. Prefer it over generic HTTP-check endpoints when certificate-level detail (issuer, SANs, key algorithm) is required.

## Known failure modes

- Host resolves to a private/reserved IP or localhost — rejected by the service
- Port not in the allowed list (only 443 and 8443 are permitted)
- Host is unreachable or times out during TLS handshake — connection error returned
- Server presents no certificate or handshake fails — TLS negotiation error
- Invalid hostname format (IP literal or malformed string) — validation error

## How this service works

SSL/TLS certificate check: expiry, issuer, SANs, chain validity, hostname match, negotiated protocol/cipher, and weak-algo warnings for a public HTTPS host. Clean JSON.

## Output

A JSON object containing: the queried hostname and port, the certificate's subject CN, issuer CN and org, validity window (not_before/not_after), days until expiry, Subject Alternative Names, key algorithm and size; chain-level booleans (is_expired, chain_valid, is_self_signed, hostname_matches, days_until_expiry); the negotiated TLS version and cipher suite; a timestamp of when the inspection ran; and a warnings array of human-readable advisories (e.g. weak algorithm, expired, self-signed, chain invalid, hostname mismatch) — empty when everything is clean.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "host"
     ],
     "properties": {
      "host": {
       "type": "string",
       "description": "Hostname to inspect (no scheme, no IP literal, not localhost or a reserved/internal suffix)"
      },
      "port": {
       "enum": [
        443,
        8443
       ],
       "type": "integer",
       "default": 443,
       "description": "TLS port; restricted to an allowlist"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object",
     "properties": {
      "host": {
       "type": "string"
      },
      "port": {
       "type": "integer"
      },
      "chain": {
       "type": "object",
       "properties": {
        "is_expired": {
         "type": "boolean"
        },
        "chain_valid": {
         "type": "boolean",
         "description": "Verified against the system trust store using only the intermediates the server presented; no AIA fetching"
        },
        "is_self_signed": {
         "type": "boolean"
        },
        "hostname_matches": {
         "type": "boolean"
        },
        "days_until_expiry": {
         "type": "integer"
        }
       }
      },
      "warnings": {
       "type": "array",
       "items": {
        "type": "string"
       },
       "description": "Human-readable advisories (weak algo, expired, self-signed, chain invalid, hostname mismatch); empty array when clean"
      },
      "connection": {
       "type": "object",
       "properties": {
        "tls_version": {
         "type": "string"
        },
        "cipher_suite": {
         "type": "string"
        }
       }
      },
      "queried_at": {
       "type": "string",
       "format": "date-time",
       "description": "When the inspection ran"
      },
      "certificate": {
       "type": "object",
       "properties": {
        "sans": {
         "type": "array",
         "items": {
          "type": "string"
         },
         
… (truncated)
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "host": "example.com",
  "port": 443,
  "chain": {
   "is_expired": false,
   "chain_valid": true,
   "is_self_signed": false,
   "hostname_matches": true,
   "days_until_expiry": 228
  },
  "warnings": [],
  "connection": {
   "tls_version": "TLS 1.3",
   "cipher_suite": "TLS_AES_128_GCM_SHA256"
  },
  "queried_at": "2026-07-02T12:00:00Z",
  "certificate": {
   "sans": [
    "example.com",
    "www.example.com"
   ],
   "key_size": 256,
   "issuer_cn": "DigiCert Global G3 TLS ECC SHA384 2020 CA1",
   "not_after": "2027-02-15T23:59:59Z",
   "issuer_org": "DigiCert Inc",
   "not_before": "2026-01-15T00:00:00Z",
   "subject_cn": "example.com",
   "key_algorithm": "ECDSA",
   "serial_number": "212351572002930070173044758915925313",
   "signature_algorithm": "ECDSA-SHA384"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ssl-tls-certificate-check-cd25a77f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ssl.use.x402atlas.com](https://www.zero.xyz/host/ssl.use.x402atlas.com/llms.txt)